CVE-2006-0299
The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript...
The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions.
Exploit likelihood
What each source reports
NVD Score used
The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions.
- Record
CVE-2006-0299- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Updated
- 2026-11-02
CVE List No score
The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions.
- Record
CVE-2006-0299- Updated
- 2026-11-02
EUVDEUVD-2006-0306 No score
The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions.
- Record
EUVD-2006-0306- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-54xf-f642-5wh5 No score
The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript...
The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions.
- Record
GHSA-54xf-f642-5wh5- Updated
- 2026-11-02
OSV No score
The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions.
- Record
CVE-2006-0299- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-0299 No score
The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions.
- Record
DEBIAN-CVE-2006-0299- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thunderbirdDebian:12 |
before 1.5.0.2-1 | 1.5.0.2-1 |
thunderbirdDebian:13 |
before 1.5.0.2-1 | 1.5.0.2-1 |
thunderbirdDebian:14 |
before 1.5.0.2-1 | 1.5.0.2-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-0299 is a medium vulnerability (CVSS 6.4) in Mozilla Firefox, published February 2, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.02%, the 81st percentile. Fixed in thunderbird 1.5.0.2-1.
References
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1625
exchange.xforce.ibmcloud.com/vulnerabilities/24437
secunia.com/advisories/18704
vupen.com/english/advisories/2006/3749
securityfocus.com/bid/16476
Show 9 moreShow less
securitytracker.com/id?1015570
bugzilla.mozilla.org/show_bug.cgi?id=322312
mozilla.org/security/announce/2006/mfsa2006-08.html
nvd.nist.gov/vuln/detail/CVE-2006-0299
github.com/advisories/GHSA-54xf-f642-5wh5
security-tracker.debian.org/tracker/CVE-2006-0299